redirection trouble

redirection trouble

[Martín]

This is the situation:



           Internal LAN machine (192.168.2.5)
                          |
                          |
                          |
(eth1 192.168.2.1) NAT LINUX ( eth0 192.168.1.10 > adsl ppp0 IP dinamic)
                          |
                          |
                          |
             Server 200.45.45.200 (service at port 10000)



This is what I intend to do:
For particular reasons, I need that a soft at 192.168.2.5 comunicate with a 
server with a service at port 10000 (UDP), but this can´t be done through 
normal NAT. So i want to establish a link between both (server and 
192.168.2.5) manually useing the NAT LINUX
So, 192.168.2.5 comunicates to 192.168.2.1 port 10000, the NAT LINUX 
redirect this traffic to the server 200.45.45.200 port 10000. The server 
will respond to the NAT LINUX who will redirect this traffic to 192.168.2.5 
(port 10000 also)
I try to do all this in this way:


iptables -t nat -I PREROUTING 1 -i eth1 -d 192.168.2.1 -p udp --dport 10000 
-j DNAT --to 200.45.45.200

iptables -t nat -I POSTROUTING 1 -o eth0 -p udp --dport 10000 -j SNAT --to 
192.168.2.5


BUT THIS IS NOT WORKING. I GET A MESSAGE FROM THE SOFT AT 192.168.2.5 
TELLING "CONNECTION TIMED OUT"... USEING TCPDUMP i get this as the only 
thing comeing back...:

200.45.45.200.10000 > 168.226.174.184.10000:  udp 8 [tos 0x40]



I would apreciate any help with this trouble
Thanks

Re: redirection trouble

[Alistair Tonner]

On November 3, 2003 08:53 pm, Martín wrote:
> This is the situation:
>
>
>
>            Internal LAN machine (192.168.2.5)
>
>
>
> (eth1 192.168.2.1) NAT LINUX ( eth0 192.168.1.10 > adsl ppp0 IP dinamic)
>
>
>
>              Server 200.45.45.200 (service at port 10000)
>
>
>
> This is what I intend to do:
> For particular reasons, I need that a soft at 192.168.2.5 comunicate with a
> server with a service at port 10000 (UDP), but this can´t be done through
> normal NAT. So i want to establish a link between both (server and
> 192.168.2.5) manually useing the NAT LINUX
> So, 192.168.2.5 comunicates to 192.168.2.1 port 10000, the NAT LINUX
> redirect this traffic to the server 200.45.45.200 port 10000. The server
> will respond to the NAT LINUX who will redirect this traffic to 192.168.2.5
> (port 10000 also)
> I try to do all this in this way:
>
>
> iptables -t nat -I PREROUTING 1 -i eth1 -d 192.168.2.1 -p udp --dport 10000
> -j DNAT --to 200.45.45.200
>
> iptables -t nat -I POSTROUTING 1 -o eth0 -p udp --dport 10000 -j SNAT --to
> 192.168.2.5

	This line is SNATing the packet on the way out eth0 to 192.168.2.5 ,,,,, 
	This NOT what you want to do ... this packet then will look like it came from 
and went to the same ip address,

	The first line takes the packet from the source pc and DNATs it out to the 
internet ip address 200.45.45.200 ... the UNDOING of this is automatic.   
However ... what you DO need to do is 

iptables -t nat -I POSTROUTING 1 -o ppp0 -p udp -dport 10000 -j SNAT --to 
(outiside ip of firewall)

  since sending the packet out the door to the internet with the source 
address of 192.168.2.5 will cause the packet to drop dead somewhere.

   Again .. .the UNDOing of this is automatic.

>
>
> BUT THIS IS NOT WORKING. I GET A MESSAGE FROM THE SOFT AT 192.168.2.5
> TELLING "CONNECTION TIMED OUT"... USEING TCPDUMP i get this as the only
> thing comeing back...:
>
> 200.45.45.200.10000 > 168.226.174.184.10000:  udp 8 [tos 0x40]
>
>
>
> I would apreciate any help with this trouble
> Thanks

-- 

	Alistair Tonner
	nerdnet.ca
	Senior Systems Analyst - RSS
	
     Any sufficiently advanced technology will have the appearance of magic.
	Lets get magical!

Re: redirection trouble

[Martín]

En Mon, 3 Nov 2003 21:21:09 -0500, Alistair Tonner <Alistair@nerdnet.ca> 
escribió:

> On November 3, 2003 08:53 pm, Martín wrote:
>> This is the situation:
>>
>>
>>
>> Internal LAN machine (192.168.2.5)
>>
>>
>>
>> (eth1 192.168.2.1) NAT LINUX ( eth0 192.168.1.10 > adsl ppp0 IP dinamic)
>>
>>
>>
>> Server 200.45.45.200 (service at port 10000)
>>
>>
>>
>> This is what I intend to do:
>> For particular reasons, I need that a soft at 192.168.2.5 comunicate 
>> with a
>> server with a service at port 10000 (UDP), but this can´t be done 
>> through
>> normal NAT. So i want to establish a link between both (server and
>> 192.168.2.5) manually useing the NAT LINUX
>> So, 192.168.2.5 comunicates to 192.168.2.1 port 10000, the NAT LINUX
>> redirect this traffic to the server 200.45.45.200 port 10000. The server
>> will respond to the NAT LINUX who will redirect this traffic to 
>> 192.168.2.5
>> (port 10000 also)
>> I try to do all this in this way:
>>
>>
>> iptables -t nat -I PREROUTING 1 -i eth1 -d 192.168.2.1 -p udp --dport 
>> 10000
>> -j DNAT --to 200.45.45.200
>>
>> iptables -t nat -I POSTROUTING 1 -o eth0 -p udp --dport 10000 -j SNAT -- 
>> to
>> 192.168.2.5
>
> 	This line is SNATing the packet on the way out eth0 to 192.168.2.5 ,,,,, 
> 	This NOT what you want to do ... this packet then will look like it came 
> from and went to the same ip address,
>
> 	The first line takes the packet from the source pc and DNATs it out to 
> the internet ip address 200.45.45.200 ... the UNDOING of this is 
> automatic.   However ... what you DO need to do is
>
> iptables -t nat -I POSTROUTING 1 -o ppp0 -p udp -dport 10000 -j SNAT --to 
> (outiside ip of firewall)
>
> since sending the packet out the door to the internet with the source 
> address of 192.168.2.5 will cause the packet to drop dead somewhere.
>
> Again .. .the UNDOing of this is automatic.

Actually may be you don´t understand what I want to do. I will explain me a 
little better:

iptables -t nat -I PREROUTING 1 -i eth1 -d 192.168.2.1 -p udp --dport 10000 
-j DNAT --to 200.45.45.200


WITH THIS LINE I WANT TO CATCH THE TRAFFIC COMEING FROM 192.168.2.5 
DIRECTED TO 192.168.2.1 : 10000 AND REDIRECT IT TO 200.45.45.200
THIS LINE SEEMS TO BE CORRECT AS I CAN SEE IN A SNIFFER



iptables -t nat -I POSTROUTING 1 -o eth0 -p udp --dport 10000 -j SNAT --to 
192.168.2.5

WITH THIS LINE I WANT TO CATCH THE RESPONSES FROM 200.45.45.200 (RESPONSES 
TO THE REDIRECTED TRAFFIC I SENT FROM 192.168.2.5) AND REDIRECT THIS 
INCOMEING TRAFFIC TO 192.168.2.5
THE INGOING AND OUTGOING PORT IS ALWAYS 10000
WHAT I NEED TO DO IS STABLISH A CONNECTION BETWEEN 192.168.2.5 AND A 
SERVICE RUNNING IN 200.45.45.200 : 10000, BUT 192.168.2.5 MUST THINK ALL 
THE TIME THAT THE SERVICE IS RUNNING AT 192.168.2.1 : 10000










>
>>
>>
>> BUT THIS IS NOT WORKING. I GET A MESSAGE FROM THE SOFT AT 192.168.2.5
>> TELLING "CONNECTION TIMED OUT"... USEING TCPDUMP i get this as the only
>> thing comeing back...:
>>
>> 200.45.45.200.10000 > 168.226.174.184.10000:  udp 8 [tos 0x40]
>>
>>
>>
>> I would apreciate any help with this trouble
>> Thanks
>



-- 
Using M2, Opera's revolutionary e-mail client: http://www.opera.com/m2/

Re: redirection trouble

[Martín]

Ok, I think I got it... but does not work. I see the traffic being 
redirected, but the conection gets lost, I got this in the snuiffer:

02:02:51.640513 192.168.2.1 > 192.168.2.5: icmp: 192.168.2.1 udp port 10000 
unrachable [tos 0x40]

Any Idea?




En Tue, 4 Nov 2003 11:20:42 +0800, Edmund Turner <eturner@monash.edu.my> 
escribió:

>
>
> Martin, Alistairs explanation and solution is correct.
> In short 192.168.2.5 will only see traffic thru and fro 192.168.2.1
> @port 10000. Put a packet analyser or a sniffer on 192.168.2.5 to
> confirm.
> In Iptables if you do a prerouting as such :
>
> #This will redirect all packets to 192.168.2.1 dport 10000 to
> 200.24.24.200:10000
>
> iptables -t nat -I PREROUTING -i eth1 -d 192.168.2.1 -p udp --dport
>> 10000 -j DNAT --to 200.45.45.200:10000
>
> You don’t have to worry about the packets coming in back from
> 200.24.24.200. They will be tracked and sent back to 192.168.2.5 as
> source IP of 192.168.2.1. Im not sure which module is responsible for
> this, but I think its done by the ip_conntrack module. Maybe someone can
> enlighten us on this?
>
>
> Regards
> edmund
>
>> -----Original Message-----
> From: netfilter-admin@lists.netfilter.org
> [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Martín
> Sent: Tuesday, November 04, 2003 10:37 AM
> To: alistair@nerdnet.ca
> Cc: netfilter@lists.netfilter.org
> Subject: Re: redirection trouble
>
> En Mon, 3 Nov 2003 21:21:09 -0500, Alistair Tonner <Alistair@nerdnet.ca>
>
> escribió:
>
>> On November 3, 2003 08:53 pm, Martín wrote:
>>> This is the situation:
>>>
>>>
>>>
>>> Internal LAN machine (192.168.2.5)
>>>
>>>
>>>
>>> (eth1 192.168.2.1) NAT LINUX ( eth0 192.168.1.10 > adsl ppp0 IP
> dinamic)
>>>
>>>
>>>
>>> Server 200.45.45.200 (service at port 10000)
>>>
>>>
>>>
>>> This is what I intend to do:
>>> For particular reasons, I need that a soft at 192.168.2.5 comunicate 
>>> with a
>>> server with a service at port 10000 (UDP), but this can´t be done 
>>> through
>>> normal NAT. So i want to establish a link between both (server and
>>> 192.168.2.5) manually useing the NAT LINUX
>>> So, 192.168.2.5 comunicates to 192.168.2.1 port 10000, the NAT LINUX
>>> redirect this traffic to the server 200.45.45.200 port 10000. The
> server
>>> will respond to the NAT LINUX who will redirect this traffic to 
>>> 192.168.2.5
>>> (port 10000 also)
>>> I try to do all this in this way:
>>>
>>>
>>> iptables -t nat -I PREROUTING 1 -i eth1 -d 192.168.2.1 -p udp --dport
>
>>> 10000
>>> -j DNAT --to 200.45.45.200
>>>
>>> iptables -t nat -I POSTROUTING 1 -o eth0 -p udp --dport 10000 -j SNAT



-- 
Using M2, Opera's revolutionary e-mail client: http://www.opera.com/m2/

Re: redirection trouble

[Alistair Tonner]

On November 4, 2003 12:15 am, Martín wrote:
> Ok, I think I got it... but does not work. I see the traffic being
> redirected, but the conection gets lost, I got this in the snuiffer:
>
> 02:02:51.640513 192.168.2.1 > 192.168.2.5: icmp: 192.168.2.1 udp port 10000
> unrachable [tos 0x40]
>
> Any Idea?


	Ummm what exists between the linux NAT box and the internet itself?

	Do you have another router in there? 
	what is meant by: ( eth0 192.168.1.10 > adsl ppp0 IP dinamic)
	Typically adsl direct connected routers to ppp daemons should 
	NOT have an ip on the ethernet interface unless you need to manage
	the router.  However I digress.
	
	Can you see the packet (after DNATting) on the way out ppp0?
	
	What if any other rules have you in the FORWARD chain.
	
	*thunks head on table* You will need to FORWARD the packets through the 
	box as well as DNATting the packets.
	
	iptables -I FORWARD -p udp -s 192.168.2.5 -d 200.24.24.200 --dport 10000 -j 
ACCEPT
	
	And again, depeinding on the presence of ESTABLISHED RELATED rules you may 
need to return them through the FORWARD chain

	Sometimes assumption of anything will get us in trouble. 


>
>
>
>
> En Tue, 4 Nov 2003 11:20:42 +0800, Edmund Turner <eturner@monash.edu.my>
>
> escribió:
> > Martin, Alistairs explanation and solution is correct.
> > In short 192.168.2.5 will only see traffic thru and fro 192.168.2.1
> > @port 10000. Put a packet analyser or a sniffer on 192.168.2.5 to
> > confirm.
> > In Iptables if you do a prerouting as such :
> >
> > #This will redirect all packets to 192.168.2.1 dport 10000 to
> > 200.24.24.200:10000
> >
> > iptables -t nat -I PREROUTING -i eth1 -d 192.168.2.1 -p udp --dport
> >
> >> 10000 -j DNAT --to 200.45.45.200:10000
> >
> > You don’t have to worry about the packets coming in back from
> > 200.24.24.200. They will be tracked and sent back to 192.168.2.5 as
> > source IP of 192.168.2.1. Im not sure which module is responsible for
> > this, but I think its done by the ip_conntrack module. Maybe someone can
> > enlighten us on this?
> >
> >
> > Regards
> > edmund
> >
> >> -----Original Message-----
> >
> > From: netfilter-admin@lists.netfilter.org
> > [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Martín
> > Sent: Tuesday, November 04, 2003 10:37 AM
> > To: alistair@nerdnet.ca
> > Cc: netfilter@lists.netfilter.org
> > Subject: Re: redirection trouble
> >
> > En Mon, 3 Nov 2003 21:21:09 -0500, Alistair Tonner <Alistair@nerdnet.ca>
> >
> > escribió:
> >> On November 3, 2003 08:53 pm, Martín wrote:
> >>> This is the situation:
> >>>
> >>>
> >>>
> >>> Internal LAN machine (192.168.2.5)
> >>>
> >>>
> >>>
> >>> (eth1 192.168.2.1) NAT LINUX ( eth0 192.168.1.10 > adsl ppp0 IP
> >
> > dinamic)
> >
> >>> Server 200.45.45.200 (service at port 10000)
> >>>
> >>>
> >>>
> >>> This is what I intend to do:
> >>> For particular reasons, I need that a soft at 192.168.2.5 comunicate
> >>> with a
> >>> server with a service at port 10000 (UDP), but this can´t be done
> >>> through
> >>> normal NAT. So i want to establish a link between both (server and
> >>> 192.168.2.5) manually useing the NAT LINUX
> >>> So, 192.168.2.5 comunicates to 192.168.2.1 port 10000, the NAT LINUX
> >>> redirect this traffic to the server 200.45.45.200 port 10000. The
> >
> > server
> >
> >>> will respond to the NAT LINUX who will redirect this traffic to
> >>> 192.168.2.5
> >>> (port 10000 also)
> >>> I try to do all this in this way:
> >>>
> >>>
> >>> iptables -t nat -I PREROUTING 1 -i eth1 -d 192.168.2.1 -p udp --dport
> >>>
> >>> 10000
> >>> -j DNAT --to 200.45.45.200
> >>>
> >>> iptables -t nat -I POSTROUTING 1 -o eth0 -p udp --dport 10000 -j SNAT

-- 

	Alistair Tonner
	nerdnet.ca
	Senior Systems Analyst - RSS
	
     Any sufficiently advanced technology will have the appearance of magic.
	Lets get magical!

Re: redirection trouble

[Alistair Tonner]

On November 4, 2003 12:15 am, Martín wrote:
> Ok, I think I got it... but does not work. I see the traffic being
> redirected, but the conection gets lost, I got this in the snuiffer:
>
> 02:02:51.640513 192.168.2.1 > 192.168.2.5: icmp: 192.168.2.1 udp port 10000
> unrachable [tos 0x40]
>
> Any Idea?


	Ummm what exists between the linux NAT box and the internet itself?

	Do you have another router in there? 
	what is meant by: ( eth0 192.168.1.10 > adsl ppp0 IP dinamic)
	Typically adsl direct connected routers to ppp daemons should 
	NOT have an ip on the ethernet interface unless you need to manage
	the router.  However I digress.
	
	Can you see the packet (after DNATting) on the way out ppp0?
	
	What if any other rules have you in the FORWARD chain.
	
	*thunks head on table* You will need to FORWARD the packets through the 
	box as well as DNATting the packets.
	
	iptables -I FORWARD -p udp -s 192.168.2.5 -d 200.24.24.200 --dport 10000 -j 
ACCEPT
	
	And again, depeinding on the presence of ESTABLISHED RELATED rules you may 
need to return them through the FORWARD chain

	Sometimes assumption of anything will get us in trouble. 


>
>
>
>
> En Tue, 4 Nov 2003 11:20:42 +0800, Edmund Turner <eturner@monash.edu.my>
>
> escribió:
> > Martin, Alistairs explanation and solution is correct.
> > In short 192.168.2.5 will only see traffic thru and fro 192.168.2.1
> > @port 10000. Put a packet analyser or a sniffer on 192.168.2.5 to
> > confirm.
> > In Iptables if you do a prerouting as such :
> >
> > #This will redirect all packets to 192.168.2.1 dport 10000 to
> > 200.24.24.200:10000
> >
> > iptables -t nat -I PREROUTING -i eth1 -d 192.168.2.1 -p udp --dport
> >
> >> 10000 -j DNAT --to 200.45.45.200:10000
> >
> > You don’t have to worry about the packets coming in back from
> > 200.24.24.200. They will be tracked and sent back to 192.168.2.5 as
> > source IP of 192.168.2.1. Im not sure which module is responsible for
> > this, but I think its done by the ip_conntrack module. Maybe someone can
> > enlighten us on this?
> >
> >
> > Regards
> > edmund
> >
> >> -----Original Message-----
> >
> > From: netfilter-admin@lists.netfilter.org
> > [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Martín
> > Sent: Tuesday, November 04, 2003 10:37 AM
> > To: alistair@nerdnet.ca
> > Cc: netfilter@lists.netfilter.org
> > Subject: Re: redirection trouble
> >
> > En Mon, 3 Nov 2003 21:21:09 -0500, Alistair Tonner <Alistair@nerdnet.ca>
> >
> > escribió:
> >> On November 3, 2003 08:53 pm, Martín wrote:
> >>> This is the situation:
> >>>
> >>>
> >>>
> >>> Internal LAN machine (192.168.2.5)
> >>>
> >>>
> >>>
> >>> (eth1 192.168.2.1) NAT LINUX ( eth0 192.168.1.10 > adsl ppp0 IP
> >
> > dinamic)
> >
> >>> Server 200.45.45.200 (service at port 10000)
> >>>
> >>>
> >>>
> >>> This is what I intend to do:
> >>> For particular reasons, I need that a soft at 192.168.2.5 comunicate
> >>> with a
> >>> server with a service at port 10000 (UDP), but this can´t be done
> >>> through
> >>> normal NAT. So i want to establish a link between both (server and
> >>> 192.168.2.5) manually useing the NAT LINUX
> >>> So, 192.168.2.5 comunicates to 192.168.2.1 port 10000, the NAT LINUX
> >>> redirect this traffic to the server 200.45.45.200 port 10000. The
> >
> > server
> >
> >>> will respond to the NAT LINUX who will redirect this traffic to
> >>> 192.168.2.5
> >>> (port 10000 also)
> >>> I try to do all this in this way:
> >>>
> >>>
> >>> iptables -t nat -I PREROUTING 1 -i eth1 -d 192.168.2.1 -p udp --dport
> >>>
> >>> 10000
> >>> -j DNAT --to 200.45.45.200
> >>>
> >>> iptables -t nat -I POSTROUTING 1 -o eth0 -p udp --dport 10000 -j SNAT

-- 

	Alistair Tonner
	nerdnet.ca
	Senior Systems Analyst - RSS
	
     Any sufficiently advanced technology will have the appearance of magic.
	Lets get magical!

Re: redirection trouble

[Martín]

I have being looking the path of packets, everything seems right. BUY i 
noticed something: the icmp port unreacheable i see and thau make the 
conection lose, seems toi originate un a firt icmp packet comeing from 
192.168.2.5 that is not being redirected to outside the NAT LINUX: Can you 
tell me hoy to redirect this kind of traffic (ICMP)



En Tue, 4 Nov 2003 13:29:07 +0800, Edmund Turner <eturner@monash.edu.my> 
escribió:

> Can you log the packet on the firewalls LAN interface and also on the
> external interface. You need to determine where the packet is getting
> lost/dropped. It would be best if you could trace the packet as it 
> reaches your LAN
> interface and watch it get NATTED out thru the external interface and as
> it comes back.
>
>
> Regards
> edmund
>
> -----Original Message-----
> From: Martín [mailto:martin@familia-fiumara.com.ar] Sent: Tuesday, 
> November 04, 2003 1:16 PM
> To: eturner@monash.edu.my
> Cc: netfilter@lists.netfilter.org
> Subject: Re: redirection trouble
>
> Ok, I think I got it... but does not work. I see the traffic being 
> redirected, but the conection gets lost, I got this in the snuiffer:
>
> 02:02:51.640513 192.168.2.1 > 192.168.2.5: icmp: 192.168.2.1 udp port
> 10000 unrachable [tos 0x40]
>
> Any Idea?
>
>
>
>
> En Tue, 4 Nov 2003 11:20:42 +0800, Edmund Turner <eturner@monash.edu.my>
>
> escribió:
>
>>
>>
>> Martin, Alistairs explanation and solution is correct.
>> In short 192.168.2.5 will only see traffic thru and fro 192.168.2.1
>> @port 10000. Put a packet analyser or a sniffer on 192.168.2.5 to
>> confirm.
>> In Iptables if you do a prerouting as such :
>>
>> #This will redirect all packets to 192.168.2.1 dport 10000 to
>> 200.24.24.200:10000
>>
>> iptables -t nat -I PREROUTING -i eth1 -d 192.168.2.1 -p udp --dport
>>> 10000 -j DNAT --to 200.45.45.200:10000
>>
>> You don’t have to worry about the packets coming in back from
>> 200.24.24.200. They will be tracked and sent back to 192.168.2.5 as
>> source IP of 192.168.2.1. Im not sure which module is responsible for
>> this, but I think its done by the ip_conntrack module. Maybe someone
> can
>> enlighten us on this?
>>
>>
>> Regards
>> edmund
>>
>>> -----Original Message-----
>> From: netfilter-admin@lists.netfilter.org
>> [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Martín
>> Sent: Tuesday, November 04, 2003 10:37 AM
>> To: alistair@nerdnet.ca
>> Cc: netfilter@lists.netfilter.org
>> Subject: Re: redirection trouble
>>
>> En Mon, 3 Nov 2003 21:21:09 -0500, Alistair Tonner
> <Alistair@nerdnet.ca>
>>
>> escribió:
>>
>>> On November 3, 2003 08:53 pm, Martín wrote:
>>>> This is the situation:
>>>>
>>>>
>>>>
>>>> Internal LAN machine (192.168.2.5)
>>>>
>>>>
>>>>
>>>> (eth1 192.168.2.1) NAT LINUX ( eth0 192.168.1.10 > adsl ppp0 IP
>> dinamic)
>>>>
>>>>
>>>>
>>>> Server 200.45.45.200 (service at port 10000)
>>>>
>>>>
>>>>
>>>> This is what I intend to do:
>>>> For particular reasons, I need that a soft at 192.168.2.5 comunicate
>
>>>> with a
>>>> server with a service at port 10000 (UDP), but this can´t be done 
>>>> through
>>>> normal NAT. So i want to establish a link between both (server and
>>>> 192.168.2.5) manually useing the NAT LINUX
>>>> So, 192.168.2.5 comunicates to 192.168.2.1 port 10000, the NAT LINUX
>>>> redirect this traffic to the server 200.45.45.200 port 10000. The
>> server
>>>> will respond to the NAT LINUX who will redirect this traffic to 
>>>> 192.168.2.5
>>>> (port 10000 also)
>>>> I try to do all this in this way:
>>>>
>>>>
>>>> iptables -t nat -I PREROUTING 1 -i eth1 -d 192.168.2.1 -p udp
> --dport
>>
>>>> 10000
>>>> -j DNAT --to 200.45.45.200
>>>>
>>>> iptables -t nat -I POSTROUTING 1 -o eth0 -p udp --dport 10000 -j
> SNAT
>
>
>



-- 
Using M2, Opera's revolutionary e-mail client: http://www.opera.com/m2/